NATIONAL UPDATE
COMPLIANCE GOVERNANCE AND THE NEED FOR A FOURTH LINE OF DEFENCE MODEL
Aged care governing bodies need independent audits to reassure them of operational compliance.
A
ll organisations engage independent, external auditors for their financial reports. However, there is a strong case for governing bodies to engage independent, external auditors for their operational performance.
While internal audit plays a key role in the corporate governance structure to provide ongoing assurance on the effective management of risk within an organisation, there are many organisations that do not have a formalised, structurally independent role of internal audit within their business. For those organisations that do have such a role, there is a case to be made for a fourth line of defence in the form of an external auditor of operational compliance. According to the Chartered Institute of Internal Auditors (CIIA), ‘internal audit is a cornerstone of an organisation’s corporate governance’. Many aged care providers will be limited in their ability to resource such a function and governing bodies will be reliant on the first and second lines to provide reports via senior management.
There have been notable instances in the Aged Care Royal Commission where such an approach has been found wanting for a variety of reasons (e.g. management withholding information, inadequate systems for documenting and interpreting risk information, processes not identifying key risks). For these reasons, boards need to be aware of potential conflicts of interest and ensure they take measures to safeguard the objectivity of internal audit. The CIIA lists four key issues for Directors to ask about and be reassured upon in regards to any internal audit function: 1. It must be structurally independent and report directly to the governing body. (Noting that any internal audit also needs to have access to management information and have a good relationship with management.) 2. The function must be properly resourced and staffed by a person with appropriate knowledge, skills and experience. 3. It should focus on the greatest risks to the organisation and have a plan executed to respond to these. Continued on page 22
The model of the Three Lines for Defence, with the fourth and fifth lines of external audit and the regulator at right.
21
